CCNA Network Services and Security Practice Test 25 — 15 Questions

Question 1

A technician reports that users on a guest wireless SSID can reach the internet but can also browse internal file shares, which should be blocked. Which two design actions most directly address that issue?

Accepted Answer

Place guest clients in a separate VLAN or VRF from internal users. Guest access should be isolated through segmentation and policy enforcement. Separate broadcast domains and ACLs are the practical way to allow internet-only access.

Answer

Increase the AP transmit power

Answer

Disable DHCP on the guest WLAN

Question 2

A network team wants to collect flow-level traffic statistics from routers to identify top talkers and bandwidth consumers. Which two statements about NetFlow are correct?

Accepted Answer

It summarizes traffic into flows instead of capturing every packet payload. NetFlow provides visibility into who is talking to whom, with what protocols and volume, making it valuable for capacity planning, troubleshooting, and security analysis.

Answer

It is primarily used to distribute time from an authoritative clock

Answer

It replaces routing protocols by advertising reachability information

Question 3

A branch office uses PAT overload on the edge router. Inside users can reach the internet, but return traffic for a newly deployed server must be mapped to a specific inside host. Which two statements are correct?

Accepted Answer

A static NAT entry can provide a consistent public-to-private mapping for the server. PAT overload is great for many inside clients sharing a public IP for outbound sessions. A public-facing server that needs predictable inbound reachability typically requires static NAT or static PAT.

Answer

Dynamic NAT always supports inbound access without additional configuration

Answer

NAT is unrelated to whether private addresses can reach the public internet

Question 4

A network operations team wants centralized logging from routers and switches and also wants meaningful severity filtering. Which two statements about syslog are correct?

Accepted Answer

Devices can send log messages to a remote syslog server for central storage. Syslog provides centralized event reporting by allowing devices to send log messages to a remote server (option A is correct). Severity levels enable filtering based on event seriousness (option B is correct). Option C is incorrect because syslog does not assign IP addresses dynamically—that is the role of DHCP. Option D is incorrect because syslog logs events and does not replace SNMP counters, which remain the primary method for collecting interface statistics.

Answer

Syslog is used to assign IP addresses dynamically to endpoints

Answer

Syslog entries replace SNMP counters for interface statistics

Question 5

An engineer configures 802.1X port-based authentication on a Cisco IOS-XE switch for a voice VLAN deployment. After applying the configuration, IP phones on interface GigabitEthernet1/0/1 fail to receive a voice VLAN and remain in an unauthenticated state. The switchport is configured as an access port with voice VLAN 10. What is the most likely cause of the failure?

Accepted Answer

Configure 'authentication host-mode multi-domain' on the interface. The correct answer is B because in a voice VLAN deployment with 802.1X, the switchport must be configured with 'authentication host-mode multi-domain' to allow both a data device (phone) and a voice device (PC behind the phone) to authenticate separately. Without this mode, the port defaults to single-host mode, which prevents the phone from receiving the voice VLAN and keeps it in an unauthenticated state.

Answer

Re-authenticate the phone using 'dot1x reauthenticate interface Gi1/0/1'

Answer

Add 'switchport voice vlan 10' under the interface

Answer

Change the port to 'authentication port-control force-authorized'

Question 6

A network administrator has configured 802.1X port-based authentication on a Cisco IOS-XE switch for a new access port connected to a user workstation. The workstation is failing to gain network access. The switch port is in the 'authorized' state, but the workstation cannot ping the default gateway. The administrator checks the running configuration and the authentication session details. What is the most likely cause of the issue?

Accepted Answer

The RADIUS server returned a VLAN ID that placed the port in a VLAN lacking connectivity to the default gateway, such as a VLAN without an SVI or incorrect subnet assignment.. The switch port is in the 'authorized' state, indicating that 802.1X authentication succeeded and the RADIUS server sent an Access-Accept. However, the workstation cannot ping the default gateway, pointing to a connectivity issue after authentication. The most likely cause is that the RADIUS server returned a VLAN assignment (via the Tunnel-Private-Group-ID attribute) that placed the port in a VLAN that is not the intended one, such as a management VLAN without a gateway, or a VLAN missing a routed SVI, leaving the workstation isolated despite successful authentication.

Answer

The RADIUS server has not been configured with the correct shared secret, causing authentication to fail silently.

Answer

The switch port is in 'err-disabled' state due to a port-security violation, preventing any traffic.

Answer

The workstation's supplicant is not configured with the correct EAP method, causing the authentication to use the guest VLAN instead.

Question 7

A network administrator has configured 802.1X port-based authentication on a Cisco IOS-XE switch port connected to a single PC. The port is in the 'authorized' state, but the PC cannot reach any network resources beyond its directly connected switch. The switch is configured to use RADIUS for authentication. What is the most likely cause of this issue?

Accepted Answer

The RADIUS server is not returning a VLAN assignment, so the port remains in the default VLAN, but the PC needs to be in a different VLAN to reach resources.. The RADIUS server can return a VLAN assignment as part of the Access-Accept message (via RADIUS attribute 64 or 81). If the server does not send a VLAN, the port remains in the configured access VLAN (often VLAN 1). If the PC needs to be in a different VLAN to reach network resources, it will be isolated even though 802.1X authentication succeeded and the port is authorized.

Answer

The switchport is in access mode and not trunking, so the PC cannot reach other VLANs.

Answer

The switch is not configured with 'aaa new-model' and therefore AAA is not enabled.

Answer

The PC is not configured for 802.1X supplicant, so it cannot authenticate properly.

Question 8

Which TWO statements correctly describe the differences between RADIUS and TACACS+ when configuring AAA on IOS-XE?

Accepted Answer

TACACS+ uses TCP port 49, while RADIUS uses UDP ports 1812 and 1813.. Options B and D are correct. TACACS+ uses TCP port 49, while RADIUS uses UDP ports 1812 (authentication) and 1813 (accounting). TACACS+ separates authentication, authorization, and accounting into three distinct processes, whereas RADIUS combines authentication and authorization. Option A is incorrect because TACACS+ encrypts the entire packet body, while RADIUS encrypts only the password. Option C is incorrect because TACACS+ supports command-level authorization, while RADIUS does not. Option E is incorrect because 802.1X port-based authentication uses RADIUS, not TACACS+.

Answer

RADIUS encrypts the entire packet body, while TACACS+ encrypts only the password.

Answer

RADIUS supports command-level authorization, whereas TACACS+ does not.

Answer

Both RADIUS and TACACS+ can be used for 802.1X port-based authentication on IOS-XE.

Question 9

Which TWO statements correctly describe the configuration and verification of AAA with RADIUS/TACACS+ and 802.1X port-based authentication on IOS-XE?

Accepted Answer

The switch port must be configured as an access port and the command 'authentication port-control auto' must be applied.. Option A is correct because 802.1X requires the switch port to be an access port (not trunk or dynamic) and the 'authentication port-control auto' command enables EAPoL-based authentication. Option D is correct because RADIUS is the recommended protocol for 802.1X; it natively supports EAP extensions and is widely used for network access control, whereas TACACS+ does not support EAP and is more suited for device administration. Option B is false because AAA authentication for 802.1X should use RADIUS, not TACACS+. Option C is false because 'aaa new-model' only activates the AAA framework; 802.1X requires additional global commands like 'dot1x system-auth-control' and per-interface configuration. Option E is false because 802.1X is typically configured on access ports and cannot be used on trunk ports to authenticate multiple VLANs; the port must be in access mode.

Answer

AAA authentication for 802.1X must be configured using TACACS+ as the protocol of choice.

Answer

The global command 'aaa new-model' is sufficient to enable 802.1X on all interfaces.

Answer

802.1X can be configured on a trunk port to authenticate multiple VLANs simultaneously.

Question 10

Drag and drop the AAA and 802.1X terms on the left to the correct descriptions on the right.

Accepted Answer

Authentication: Verifies the identity of the user or device attempting to access the network.. AAA components: authentication verifies identity, authorization grants rights, accounting logs activities. 802.1X roles: supplicant is the client, authenticator is the switch/AP, and authentication server (RADIUS) validates and authorizes.

Answer

Authorization: Determines what resources the authenticated user or device is allowed to access.

Answer

Accounting: Logs and tracks user activities, such as login times, commands executed, and data transferred.

Answer

Supplicant: The client device that requests network access and provides credentials to the authenticator.

Question 11

A network administrator is troubleshooting connectivity from the 192.168.10.0/24 subnet to the server at 10.10.10.10. Users report that they can reach the server initially, but after a few minutes, connectivity drops and only returns after the interface is cleared. The administrator reviews the router's running configuration and ACL configuration. What is the most likely cause of the intermittent connectivity loss?

Accepted Answer

Remove the 'established' keyword from the ACL to allow initial TCP connections.. The 'established' keyword in an ACL permits TCP packets that have the ACK or RST bit set, which are responses to outbound connections. However, it does not permit the initial SYN packet from the client to the server. Since users can reach the server initially (likely due to a temporary permit or stateful inspection elsewhere), but connectivity drops after a few minutes, the issue is that the ACL is blocking the initial SYN packets needed to establish new TCP connections. Removing the 'established' keyword (or adding a permit for the initial SYN) resolves this by allowing all TCP traffic from the source subnet.

Answer

Apply the ACL inbound on the interface instead of outbound.

Answer

Add a permit statement for UDP traffic to allow DNS resolution.

Answer

Change the wildcard mask to 0.0.0.255 to match the subnet more accurately.

Question 12

Which TWO statements correctly describe the behavior of standard ACLs and their placement on interfaces?

Accepted Answer

Standard ACLs filter traffic based on source IP address only.. Standard ACLs filter traffic based solely on the source IP address, using numbers 1–99 or 1300–1999 in classic Cisco IOS. They do not consider destination IP, protocol, or port numbers. Because they lack granularity, placing them close to the destination (option D) prevents them from inadvertently blocking traffic that should be permitted, as they cannot distinguish between traffic destined for different services on the same destination host.

Answer

Standard ACLs should be placed as close to the source as possible.

Answer

Standard ACLs can filter traffic based on destination IP address.

Answer

Standard ACLs can filter traffic based on TCP or UDP port numbers.

Question 13

Which TWO statements correctly describe the behavior of standard ACLs when applied to an interface?

Accepted Answer

Standard ACLs should be placed as close to the destination as possible.. Standard ACLs filter traffic based solely on the source IP address, not the destination. Because they do not consider destination addresses, placing them as close to the destination as possible prevents them from inadvertently blocking traffic that should reach other parts of the network. This placement ensures that only the intended traffic is filtered at the final hop before the destination.

Answer

Standard ACLs filter traffic based on source and destination IP addresses.

Answer

Standard ACLs can filter traffic based on protocol type (TCP, UDP, ICMP).

Answer

Standard ACLs are applied to interfaces in the inbound direction only.

Question 14

Drag and drop the ACL commands and concepts on the left to their correct descriptions on the right.

Accepted Answer

Standard ACL. Standard ACLs filter only by source IP. Extended ACLs offer more granular filtering. Named ACLs use names for identification. Implicit deny is the default deny-all at the end. Inbound ACLs process traffic before routing, outbound after routing.

Answer

Extended ACL

Answer

Named ACL

Answer

Implicit deny

Question 15

A network engineer notices that internal hosts (192.168.1.0/24) can reach external servers on the internet, but replies from external servers never reach the internal hosts. The router R1 is configured with dynamic NAT to translate the internal subnet to a pool of public IPs (203.0.113.10-203.0.113.20). The engineer runs 'show ip nat translations' and sees only a few stale translations. What is the most likely cause of the issue?

Accepted Answer

The outside interface (GigabitEthernet0/0) is missing the 'ip nat outside' command.. The correct answer is B because the 'ip nat outside' command must be applied to the interface facing the external network (GigabitEthernet0/0) for the router to translate return traffic. Without it, the router does not perform NAT on packets arriving on that interface, so replies from external servers are forwarded without translation back to the inside local IPs, which are not routable on the internet. The stale translations indicate that outbound translations were created but never used for return traffic, confirming the missing outside interface command.

Answer

The access list 'NAT' is incorrect; it should permit only specific hosts, not the entire subnet.

Answer

The NAT configuration lacks the 'overload' keyword, so the pool is exhausted quickly.

Answer

The NAT pool 'POOL' has too few addresses; it should be expanded to a /24 subnet.